dosyasorgutakip[.]com

This domain operates as a fraudulent replica of the official UYAP Bilişim Sistemi, a Turkish legal portal used by citizens to access court documents and government services. Analysis indicates the site is designed to harvest login credentials, personal identification numbers, and other sensitive data under the guise of legitimate government services. The page title, 'UYAP Bilişim Sistemi | Ana Sayfa | Vatandaş Portal,' precisely mimics the branding of the authentic portal, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 03, 2026, through Dynadot LLC, an unusually future-dated creation that may suggest an attempt to evade immediate detection. It resolves to the IP address 172.67.190.51, protected by Cloudflare, and uses a Let's Encrypt SSL certificate to present a false sense of security. Security engines on VirusTotal flagged the domain as malicious in 16 out of 95 scans, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is currently offline, though prior activity remains a concern. Users who visited dosyasorgutakip.com should assume credential compromise and take immediate action. Reset all passwords associated with the UYAP portal or any other service where the same credentials were reused. Enable multi-factor authentication on all critical accounts, especially those linked to government or financial services. Monitor bank statements, credit reports, and official communications for signs of unauthorized access or identity fraud. If personal identification numbers or legal documents were entered, report the incident to the relevant authorities and consider placing a fraud alert on credit files. The domain’s use of Cloudflare and Let’s Encrypt demonstrates how attackers exploit legitimate infrastructure to enhance deception, underscoring the need for heightened vigilance.